netsupport | 8ff6ffd0e4f01e1687f035835ef0c20b61f1b48f73c90052b385356ab04cfaef

Analysis

max time kernel
31s
max time network
127s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
Size

2.5MB
MD5

930dafe31a08adcef3cc066d16d40982
SHA1

134c131779666424cc98fd15e384d174cfcf16e6
SHA256

36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c
SHA512

1d9a6d5219bf7cdf9b61b75b0c1dbcd240685a4c9308f950efc4f7daccf05eaea09baf248668ffd02a6ce6db8a6007d03b1c746b6d84873112ce30586c6887ea
SSDEEP

49152:suJdxkp92TMp2OJSyli/TlV56nNeDyQ41Huw9If8DQtqKPi/IBF:Bd6Ugp2Jx6UyQ41uw9IkDUiu

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops startup file 1 IoCs

Processes:

36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunn2023.ini.lnk	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe

Executes dropped EXE 1 IoCs

Processes:

client32.exe

pid process

572 client32.exe

pid	process
572	client32.exe

Loads dropped DLL 10 IoCs

Processes:

36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.execlient32.exe

pid	process
1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
572	client32.exe
572	client32.exe
572	client32.exe
572	client32.exe
572	client32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

client32.exe

description pid process

Token: SeSecurityPrivilege 572 client32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

client32.exe

pid process

572 client32.exe

description	pid	process
Token: SeSecurityPrivilege	572	client32.exe

pid	process
572	client32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe

description	pid	process	target process
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe
PID 1736 wrote to memory of 572	1736	36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe	client32.exe

C:\Users\Admin\AppData\Local\Temp\36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe
"C:\Users\Admin\AppData\Local\Temp\36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe
"C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\supwinupdate\HTCTL32.DLL

Filesize
299KB

MD5
369388ac78ca4ca8a64219cf9aafad4c

SHA1
dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

SHA256
c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

SHA512
7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\NSM.LIC

Filesize
258B

MD5
06fa55f6114fd4155223638237dc4b1d

SHA1
a7662e7466cfa9ab554f68bb679c2807e6d3afad

SHA256
e8fea18a30729f9a3b56460964d9e9f74a7075732cf7a522456280903ddd9cf7

SHA512
df5b984a9ae7a65c7213328c14c172296a79af5079a035d7b4e77c55c80856eebcb58c8436fc2b5c33b08dd81a7d646eb0829d41e7a45c4e45039aea5574bf5e

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\PCICAPI.dll

Filesize
100KB

MD5
f0d7d2a77eee2b3146405d3ad0d56230

SHA1
37c323faf58584606ee5847cb9a25346c588f78f

SHA256
f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

SHA512
861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\PCICL32.dll

Filesize
3.3MB

MD5
1274cca13cc5e37ca94d35e5b0673e89

SHA1
a8754c94f88273c304bc45a5afd61a383bb52117

SHA256
cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

SHA512
52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\client32.ini

Filesize
1009B

MD5
95bfe0d689147edf522ccbc7b62f6400

SHA1
633a14f96e2b022fb1e05e4d5308b49f9439405c

SHA256
2949b1bc32a6572c854f1185084d2f9f252e86c0ead6f15e3716b24ba1147b85

SHA512
788064d17b897f70f3bf7cd474266d6d307600184628341c1863c129bff46e74a4f3f833f2ab5bfaa0b15a462efb5fbafb01f136f18a4611259cb4c7236709ad

Download Submit
C:\Users\Admin\AppData\Roaming\supwinupdate\pcichek.dll

Filesize
8KB

MD5
07b474ab5c503f35873b94cd48d01592

SHA1
e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

SHA256
c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

SHA512
a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\HTCTL32.DLL

Filesize
299KB

MD5
369388ac78ca4ca8a64219cf9aafad4c

SHA1
dfa6c01c55ac799f041c65df9a35aba8cf0d8c2d

SHA256
c76ee648639406c81469772311c39b46042bf1b91e47d9201908f3cf70407f30

SHA512
7d090f033ffc48b870d692877f3804a69dcb1ff61b96936f1ab77bf42b156839bfd787c387bc7d642c732868e3dcd8c0ff3b319f057c0157b5afc6843b302bc5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\PCICHEK.DLL

Filesize
8KB

MD5
07b474ab5c503f35873b94cd48d01592

SHA1
e6f699d6c021d9d434cc6a4e68516c4c2ac80ddc

SHA256
c8911c298f860de85037f8634e8539627f5a1c13b1fffe5568d63612e29b9cd4

SHA512
a995b0d1fba6e99dd89afbf5161efc18b0268c001c27155876e642abc8639f79c2c320530039cfa5ec9f6ca10e1d716060b0fb86414245f578f920f11c9bbbc8

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\PCICL32.DLL

Filesize
3.3MB

MD5
1274cca13cc5e37ca94d35e5b0673e89

SHA1
a8754c94f88273c304bc45a5afd61a383bb52117

SHA256
cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd

SHA512
52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\supwinupdate\pcicapi.dll

Filesize
100KB

MD5
f0d7d2a77eee2b3146405d3ad0d56230

SHA1
37c323faf58584606ee5847cb9a25346c588f78f

SHA256
f043653ab1b8fbe5a33922df5b4fb46797e9694e5fcee807b97cc6aaef650131

SHA512
861258b5b97665f649437fd25aadc5dc66e5bc5a87d7482300f9931810f0d89d0ed9c01890cd038daa7c6d2f1850a3208fc20b3c1dc2e588c7688e228a4baade

Download Submit